When you connect a USB Device to one of the LEM agent nodes - can you see that event within the LEM Console?
The event should appear in the Monitor section under IT Operations > System Events:
Image may be NSFW.
Clik here to view.
If the event is not appearing - that would be the cause of the rule not triggering & it could be an issue with the USB Defender.
